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(54) Secure vehicle control 

(57) An electronic engine management system comprises a first microprocessor for controlling engine function, and a 
removable token such as a contactless smart card havng an electronic memory element included therein and optionally a 
further microprocessor. Interface means Is provided between the token memory and the first microprocessor which may 
comprise a further microprocessor. At least part of the Information required by the first mircroprocessor (eg programming or 
data) for controlling engine function Is held in the token memory. Therefore the vehicle cannot be operated without the 
token, even if the token reader is short-circuited. 
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At least one drawing originally filed was informal and the print reproduced here is taken from a later filed forma! copy. 
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ENGINE MANAGEMENT SYSTEM 

The present invention relates to an electronic engine 
management system which includes a microprocessor for 
controlling engine function. 

Electronic management systems have been previously 
proposed for internal combustion engines which utilise a 
microprocessor to control various aspects of engine 
function. Such systems have found particular applicability 
in automobiles having spark ignition engines and often 
electronic fuel injection, electronic ignition etc. It is 
usually the case that if the electronic management system is 
inoperative then the engine will not function and the car 
cannot be driven. Enabling and disabling of the system is 
normally achieved using a simple mechanical key such as 
might be found in most automobiles functioning an ignition 
and starter motor switch and often a steering lock key. 
However, the key and lock can be bypassed by detaching the 
appropriate wires for ignition and starter motor function 
and a steering lock can be physically removed. Thus the car 
can be driven even if the key is not available which means 
that the car can be stolen easily. 
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The digital progranming of an engine managemen'k 
microprocessor offers an opportunity to enhance vehicle 
security which has not been exploited to date to any great 
extent. 

According to one aspect of the present invention there 
is provided an electronic engine management system 
comprising a control unit including a microprocessor for 
controlling at least one engine function in accordance with 
a control program, a removable token having a non-volatile 
electronic memory element included therein, and interface 
means whereby data may be passed from the token to the 
microprocessor, wherein data representing a part of the 
control program is held in the token memory element. 

Conveniently, the information held in the token memory 
is loaded into volatile memory in the first microprocessor 
such that the information is lost when the engine is 
switched off. 

The token typically includes a microprocessor as well 
as the memory element. It is particularly preferred that a 
contactless integrated circuit card is used which 
communicates using inductive coupling at radio frequencies. 
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The interface may also contain a microprocessor for 
controlling the transfer of information from the token to 
the first processor. 

A system according to the present invention has the 
advantage that it can be used to provide a further level of 
security when installed in an automobile which cannot be 
simply bypassed by physical means. 

An example of the present invention will now be 
described with reference to the accompanying drawing, in 
which 

Figure 1 shows a schematic diagram of a conventional 
engine management arrangement; and 

Figure 2 shows a schematic diagram of a system 
according to one embodiment of the invention with parts 
omitted for clarity. 

Referring now to Figure 1, the system shown comprises 
a management unit 10, an engine 15, a battery 20 and a 
steering lock/ ignition key arrangement 25. The key 
arrangement 25 serves as a master switch for power from the 
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battery 20 to the electrical components of the system such 
as the starter motor and ignition system. The management 
unit serves to control the electrical aspects of engine 
function when power is supplied. Typical controlled 
functions are ignition timing, advance/retard, and 
electronic fuel injection timing and quantity. However, 
this system has the disadvantage that it will still function 
if the key arrangement 25 is bypassed and the appropriate 
electrical connections made. The present invention is 
intended to overcome this problem by utilising the digital 
program nature of the management unit. 

Referring now to Figure 2, the system shown therein 
differs from that described above in that the management 
unit 10 is connected to a reader tmit 30 which can 
communicate with a removable smart card 35. These are 
preferably a contactless card and reader which communicate 
by inductive coupling and may typically be as described in 
GB2173523. However, other types of contact or contactless 
cards and readers may be applicable according to 
requirements. The card 35 include a microprocessor and a 
memory unit as well as the required structures for 
communicating with the reader 30. In the present case, the 
reader 30 and the card 35 both contain loop aerials. The 
reader unit transmits data to the card by means of RF 
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signals at sufficient power that when the card 35 is within 
range, the appropriate power to drive the electrical 
components contained therein is obtained from the signal 
induced in the card loop aerial by the data from the reader. 
Data is commtmicated from the card to the reader by varying 
the level of power consxmed by the card aerial and 
components, which variation can be monitored at the reader 
30. 

The contactless arrangement described has a particular - 
advantage in automobile applications in that it is not 
affected by vibration to the same extent as a physical 
contact type card might be where contacts might be 
disconnected or displaced by vibrations due to movement. 

The power for the reader 30 is drawn from the battery 
20 or the engine generated electricity supply when running, 
and so can be under ultimate control of the ignition key 
arrangement 25. However, a portion of the data required by 
the management unit 10 can be held in the card memory so 
that the management unit 10 cannot control the engine 15 
until the card 35 is present. This can be achieved because 
the management unit is digitally programmed and so it is 
easy to locate part of the program in the card memory and 
provide the management unit with programming to allow it to 
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communicate with the card 35. 

In one embodiment the programming of the management 
iinit is simple and merely requires data to be loaded into 
volatile memory therein before it will function. In this 
case a microprocessor would be included in the reader 30 to 
control data flow to and from the card. It is also possible 
that the management unit processor could be programmed to 
control the reader function. 

The data transferred from the card might be a simple 
i.d. code, basic settings or signals to start the engine or 
might be control information which must be accessed 
continually during use. This would prevent the card 35 from 
being removed once the engine was started. For security 
purposes, each management unit/card combination may store 
different parts of the control information or program in the 
card memory, so that a card from one vehicle cannot be used 
to operate another vehicle having a similar engine 
management system. 
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CLAIMS 

1. An electronic engine management system, comprising a 
control unit including a microprocessor for controlling at 
least one engine function in accordance with a control 
program, a removable token having a non-volatile electronic 
memory element included therein, and interface means whereby 
data may be passed from the token to the microprocessor, 
wherein data representing a part of the control program is 
held in the token memory element. 

2. An engine management system as claimed in claim 1, 
wherein, in use, the data held in the token memory is loaded 
into volatile memory in the control unit. 

3. An engine management system as claimed in claim 1 or 2, 
wherein the token includes a microprocessor. 

4. An engine management system as claimed in claim 3, 
wherein the token is a contactless token which communicates 
with the interface using inductive coupling at radio 
frequencies . 

5. An engine management system as claimed in any preceding 
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Claim, wherein the interface contains a microprocessor for 
controlling the transfer of information from the token to 
the control unit. 

6. An engine management system as claimed in einy preceding 
claim, wherein the data stored in the token memory element 
is such that the control unit must repeatedly receive the 
data driving the operation thereof , whereby the engine 
cannot operate in the aJ:>sence of the token. 

7. An engine management system, sxibstantially as described 
with reference to Figure 2. 
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